livedesk 0.1.210 → 0.1.211

package/hub/src/agents/agent-permissions.js

@@ -1,200 +1,209 @@
-import crypto from 'node:crypto';
-import { getAgentToolDefinition } from './agent-tool-registry.js';
-
-export const AGENT_PERMISSION_MODES = Object.freeze(['ask', 'safe-auto', 'full-access', 'custom']);
-export const AGENT_PERMISSION_DECISIONS = Object.freeze(['allow', 'ask', 'deny']);
-export const AGENT_PERMISSION_CATEGORIES = Object.freeze([
-  'read',
-  'processControl',
-  'serviceControl',
-  'applicationControl',
-  'fileRead',
-  'fileWrite',
-  'fileDelete',
-  'shell',
-  'script',
-  'softwareInstall',
-  'network',
-  'systemPower',
-  'systemConfiguration',
-  'userAccount'
-]);
-
-const DEFAULT_CUSTOM_CATEGORIES = Object.freeze({
-  read: 'allow',
-  processControl: 'ask',
-  serviceControl: 'ask',
-  applicationControl: 'ask',
-  fileRead: 'ask',
-  fileWrite: 'ask',
-  fileDelete: 'ask',
-  shell: 'ask',
-  script: 'ask',
-  softwareInstall: 'ask',
-  network: 'ask',
-  systemPower: 'ask',
-  systemConfiguration: 'ask',
-  userAccount: 'deny'
-});
-
-const PRESET_CATEGORIES = Object.freeze({
-  ask: {
-    ...DEFAULT_CUSTOM_CATEGORIES,
-    userAccount: 'ask'
-  },
+import crypto from 'node:crypto';
+import { getAgentToolDefinition } from './agent-tool-registry.js';
+
+export const AGENT_PERMISSION_MODES = Object.freeze(['ask', 'safe-auto', 'full-access', 'custom']);
+export const AGENT_PERMISSION_DECISIONS = Object.freeze(['allow', 'ask', 'deny']);
+export const AGENT_PERMISSION_CATEGORIES = Object.freeze([
+  'read',
+  'processControl',
+  'serviceControl',
+  'applicationControl',
+  'fileRead',
+  'fileWrite',
+  'fileDelete',
+  'shell',
+  'script',
+  'softwareInstall',
+  'network',
+  'systemPower',
+  'systemConfiguration',
+  'userAccount'
+]);
+
+const DEFAULT_CUSTOM_CATEGORIES = Object.freeze({
+  read: 'allow',
+  processControl: 'ask',
+  serviceControl: 'ask',
+  applicationControl: 'ask',
+  fileRead: 'ask',
+  fileWrite: 'ask',
+  fileDelete: 'ask',
+  shell: 'ask',
+  script: 'ask',
+  softwareInstall: 'ask',
+  network: 'ask',
+  systemPower: 'ask',
+  systemConfiguration: 'ask',
+  userAccount: 'deny'
+});
+
+const PRESET_CATEGORIES = Object.freeze({
+  ask: {
+    ...DEFAULT_CUSTOM_CATEGORIES,
+    userAccount: 'ask'
+  },
   'safe-auto': {
     read: 'allow',
     processControl: 'allow',
     serviceControl: 'allow',
-    applicationControl: 'allow',
+    // launch_application accepts an executable path, so allowing it would
+    // provide a shell-equivalent escape hatch (for example powershell.exe).
+    applicationControl: 'ask',
     fileRead: 'allow',
     fileWrite: 'allow',
     fileDelete: 'ask',
     shell: 'ask',
-    script: 'allow',
-    softwareInstall: 'ask',
-    network: 'allow',
-    systemPower: 'ask',
-    systemConfiguration: 'ask',
-    userAccount: 'deny'
-  },
-  'full-access': {
-    read: 'allow',
-    processControl: 'allow',
-    serviceControl: 'allow',
-    applicationControl: 'allow',
-    fileRead: 'allow',
-    fileWrite: 'allow',
-    fileDelete: 'allow',
-    shell: 'allow',
-    script: 'allow',
-    softwareInstall: 'allow',
-    network: 'allow',
-    systemPower: 'allow',
-    systemConfiguration: 'allow',
-    userAccount: 'ask'
-  }
-});
-
-const TOOL_CATEGORY_ALIASES = Object.freeze({
-  'process.list': 'read',
-  'service.status': 'read',
-  'system.health': 'read',
-  'gpu.status': 'read',
-  'disk.status': 'read',
-  'diagnostics.collect': 'read'
-});
-
-function normalizeIds(value) {
-  return [...new Set((Array.isArray(value) ? value : [])
-    .map(item => String(item || '').trim())
-    .filter(Boolean))].sort().slice(0, 500);
-}
-
-function normalizeDecision(value, fallback = 'ask') {
-  return AGENT_PERMISSION_DECISIONS.includes(String(value || '').toLowerCase())
-    ? String(value).toLowerCase()
-    : fallback;
-}
-
-export function normalizeAgentPermissionCategories(value, fallback = DEFAULT_CUSTOM_CATEGORIES) {
-  const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-  return Object.fromEntries(AGENT_PERMISSION_CATEGORIES.map(category => [
-    category,
-    normalizeDecision(source[category], fallback[category] || 'ask')
-  ]));
-}
-
-export function getPresetAgentPermissionCategories(mode, customCategories) {
-  const normalizedMode = AGENT_PERMISSION_MODES.includes(mode) ? mode : 'ask';
-  if (normalizedMode === 'custom') return normalizeAgentPermissionCategories(customCategories);
-  return normalizeAgentPermissionCategories(PRESET_CATEGORIES[normalizedMode] || PRESET_CATEGORIES.ask);
-}
-
-export function createAgentPermissionPolicy({ mode = 'ask', deviceIds = [], customCategories, maxToolCalls, now = new Date() } = {}) {
-  const normalizedMode = AGENT_PERMISSION_MODES.includes(String(mode)) ? String(mode) : 'ask';
-  const categories = getPresetAgentPermissionCategories(normalizedMode, customCategories);
-  const defaultMax = normalizedMode === 'ask' ? 30 : normalizedMode === 'safe-auto' ? 50 : normalizedMode === 'full-access' ? 100 : 50;
-  const requestedMax = Number(maxToolCalls);
-  const boundedMax = Number.isFinite(requestedMax) ? Math.max(1, Math.min(100, Math.floor(requestedMax))) : defaultMax;
-  const createdAt = new Date(now).toISOString();
-  const expiresAt = new Date(new Date(now).getTime() + 60 * 60 * 1000).toISOString();
-  return {
-    policyVersion: 1,
-    mode: normalizedMode,
-    deviceIds: normalizeIds(deviceIds),
-    categories,
-    maxToolCalls: boundedMax,
-    expiresAt,
-    createdAt
-  };
-}
-
-export function hashAgentPermissionPolicy(policy) {
-  const canonical = JSON.stringify({
-    policyVersion: policy?.policyVersion,
-    mode: policy?.mode,
-    deviceIds: normalizeIds(policy?.deviceIds),
-    categories: normalizeAgentPermissionCategories(policy?.categories),
-    allowedAppIds: normalizeIds(policy?.allowedAppIds),
-    allowedServiceNames: normalizeIds(policy?.allowedServiceNames),
-    allowedFileRoots: normalizeIds(policy?.allowedFileRoots),
-    allowedDomains: normalizeIds(policy?.allowedDomains),
-    allowedExecutables: normalizeIds(policy?.allowedExecutables),
-    maxToolCalls: Number(policy?.maxToolCalls) || 0,
-    expiresAt: String(policy?.expiresAt || '')
-  });
-  return crypto.createHash('sha256').update(canonical).digest('hex');
-}
-
-function targetIdsFromArgs(args, fallback = []) {
-  return normalizeIds(args?.deviceIds?.length ? args.deviceIds : fallback);
-}
-
-function isSafeAutoRelativePath(value) {
-  const text = String(value || '').trim();
-  if (!text || text.length > 600 || text.startsWith('/') || /^[A-Za-z]:[\\/]/.test(text) || text.startsWith('\\\\')) return false;
-  const segments = text.replaceAll('\\', '/').split('/').filter(Boolean);
-  return segments.length > 0 && !segments.includes('..');
-}
-
+    // A writable script directory must never become an auto-execution path.
+    script: 'ask',
+    softwareInstall: 'ask',
+    network: 'allow',
+    systemPower: 'ask',
+    systemConfiguration: 'ask',
+    userAccount: 'deny'
+  },
+  'full-access': {
+    read: 'allow',
+    processControl: 'allow',
+    serviceControl: 'allow',
+    applicationControl: 'allow',
+    fileRead: 'allow',
+    fileWrite: 'allow',
+    fileDelete: 'allow',
+    shell: 'allow',
+    script: 'allow',
+    softwareInstall: 'allow',
+    network: 'allow',
+    systemPower: 'allow',
+    systemConfiguration: 'allow',
+    userAccount: 'ask'
+  }
+});
+
+const TOOL_CATEGORY_ALIASES = Object.freeze({
+  'process.list': 'read',
+  'service.status': 'read',
+  'system.health': 'read',
+  'gpu.status': 'read',
+  'disk.status': 'read',
+  'diagnostics.collect': 'read'
+});
+
+function normalizeIds(value) {
+  return [...new Set((Array.isArray(value) ? value : [])
+    .map(item => String(item || '').trim())
+    .filter(Boolean))].sort().slice(0, 500);
+}
+
+function normalizeDecision(value, fallback = 'ask') {
+  return AGENT_PERMISSION_DECISIONS.includes(String(value || '').toLowerCase())
+    ? String(value).toLowerCase()
+    : fallback;
+}
+
+export function normalizeAgentPermissionCategories(value, fallback = DEFAULT_CUSTOM_CATEGORIES) {
+  const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+  return Object.fromEntries(AGENT_PERMISSION_CATEGORIES.map(category => [
+    category,
+    normalizeDecision(source[category], fallback[category] || 'ask')
+  ]));
+}
+
+export function getPresetAgentPermissionCategories(mode, customCategories) {
+  const normalizedMode = AGENT_PERMISSION_MODES.includes(mode) ? mode : 'ask';
+  if (normalizedMode === 'custom') return normalizeAgentPermissionCategories(customCategories);
+  return normalizeAgentPermissionCategories(PRESET_CATEGORIES[normalizedMode] || PRESET_CATEGORIES.ask);
+}
+
+export function createAgentPermissionPolicy({ mode = 'ask', deviceIds = [], customCategories, maxToolCalls, now = new Date() } = {}) {
+  const normalizedMode = AGENT_PERMISSION_MODES.includes(String(mode)) ? String(mode) : 'ask';
+  const categories = getPresetAgentPermissionCategories(normalizedMode, customCategories);
+  const defaultMax = normalizedMode === 'ask' ? 30 : normalizedMode === 'safe-auto' ? 50 : normalizedMode === 'full-access' ? 100 : 50;
+  const requestedMax = Number(maxToolCalls);
+  const boundedMax = Number.isFinite(requestedMax) ? Math.max(1, Math.min(100, Math.floor(requestedMax))) : defaultMax;
+  const createdAt = new Date(now).toISOString();
+  const expiresAt = new Date(new Date(now).getTime() + 60 * 60 * 1000).toISOString();
+  return {
+    policyVersion: 1,
+    mode: normalizedMode,
+    deviceIds: normalizeIds(deviceIds),
+    categories,
+    maxToolCalls: boundedMax,
+    expiresAt,
+    createdAt
+  };
+}
+
+export function hashAgentPermissionPolicy(policy) {
+  const canonical = JSON.stringify({
+    policyVersion: policy?.policyVersion,
+    mode: policy?.mode,
+    deviceIds: normalizeIds(policy?.deviceIds),
+    categories: normalizeAgentPermissionCategories(policy?.categories),
+    allowedAppIds: normalizeIds(policy?.allowedAppIds),
+    allowedServiceNames: normalizeIds(policy?.allowedServiceNames),
+    allowedFileRoots: normalizeIds(policy?.allowedFileRoots),
+    allowedDomains: normalizeIds(policy?.allowedDomains),
+    allowedExecutables: normalizeIds(policy?.allowedExecutables),
+    maxToolCalls: Number(policy?.maxToolCalls) || 0,
+    expiresAt: String(policy?.expiresAt || '')
+  });
+  return crypto.createHash('sha256').update(canonical).digest('hex');
+}
+
+function targetIdsFromArgs(args, fallback = []) {
+  return normalizeIds(args?.deviceIds?.length ? args.deviceIds : fallback);
+}
+
+function isSafeAutoRelativePath(value) {
+  const text = String(value || '').trim();
+  if (!text || text.length > 600 || text.startsWith('/') || /^[A-Za-z]:[\\/]/.test(text) || text.startsWith('\\\\')) return false;
+  const segments = text.replaceAll('\\', '/').split('/').filter(Boolean);
+  return segments.length > 0 && !segments.includes('..');
+}
+
 function safeAutoConstraint(tool, args, mode) {
   if (mode !== 'safe-auto') return '';
   if (tool.category === 'fileWrite' && !isSafeAutoRelativePath(args?.path)) {
     return 'Safe Auto file writes are limited to relative paths inside the LiveDesk files directory.';
   }
-  if (tool.category === 'script') {
-    const scriptPath = String(args?.path || '').trim().toLowerCase();
-    if (!isSafeAutoRelativePath(scriptPath) || !scriptPath.replaceAll('\\', '/').startsWith('scripts/') || !/\.(ps1|psm1|sh|bash|py|js|mjs|cmd|bat)$/.test(scriptPath)) {
-      return 'Safe Auto scripts must be registered relative script files inside the LiveDesk files directory.';
+  if (tool.category === 'fileWrite') {
+    const filePath = String(args?.path || '').trim().replaceAll('\\', '/').toLowerCase();
+    if (filePath === 'scripts' || filePath.startsWith('scripts/')) {
+      return 'Safe Auto cannot write files inside the script directory.';
     }
   }
-  return '';
-}
-
-export function evaluateAgentToolPermission({ policy, toolName, arguments: args = {}, deviceIds = [] } = {}) {
-  const tool = getAgentToolDefinition(toolName);
-  if (!tool) return { decision: 'deny', category: 'unknown', risk: 'critical', reason: 'Unknown or unregistered Agent tool.' };
-  const allowed = new Set(normalizeIds(policy?.deviceIds));
-  const requested = targetIdsFromArgs(args, deviceIds);
-  if (requested.some(deviceId => !allowed.has(deviceId))) {
-    return { decision: 'deny', category: tool.category, risk: tool.risk, reason: 'The tool requested a device outside the selected Agent scope.' };
-  }
-  if (policy?.expiresAt && Date.parse(policy.expiresAt) <= Date.now()) {
-    return { decision: 'deny', category: tool.category, risk: 'high', reason: 'The Agent permission policy has expired.' };
-  }
-  const category = TOOL_CATEGORY_ALIASES[tool.name.replace(/^livedesk\./, '')] || tool.category;
-  const constraintError = safeAutoConstraint(tool, args, policy?.mode);
-  if (constraintError) {
-    return { decision: 'deny', category, risk: tool.risk, reason: constraintError };
-  }
-  const decision = normalizeDecision(policy?.categories?.[category], 'deny');
-  return {
-    decision,
-    category,
-    risk: tool.risk,
-    reason: decision === 'allow' ? `Allowed by ${policy?.mode || 'current'} policy.` : decision === 'ask' ? 'This operation requires approval in the current policy.' : 'This operation is denied by the current policy.'
-  };
-}
-
-export const DEFAULT_CUSTOM_AGENT_PERMISSION_CATEGORIES = Object.freeze({ ...DEFAULT_CUSTOM_CATEGORIES });
+  if (tool.category === 'script') {
+    const scriptPath = String(args?.path || '').trim().toLowerCase();
+    if (!isSafeAutoRelativePath(scriptPath) || !scriptPath.replaceAll('\\', '/').startsWith('scripts/') || !/\.(ps1|psm1|sh|bash|py|js|mjs|cmd|bat)$/.test(scriptPath)) {
+      return 'Safe Auto scripts must be registered relative script files inside the LiveDesk files directory.';
+    }
+  }
+  return '';
+}
+
+export function evaluateAgentToolPermission({ policy, toolName, arguments: args = {}, deviceIds = [] } = {}) {
+  const tool = getAgentToolDefinition(toolName);
+  if (!tool) return { decision: 'deny', category: 'unknown', risk: 'critical', reason: 'Unknown or unregistered Agent tool.' };
+  const allowed = new Set(normalizeIds(policy?.deviceIds));
+  const requested = targetIdsFromArgs(args, deviceIds);
+  if (requested.some(deviceId => !allowed.has(deviceId))) {
+    return { decision: 'deny', category: tool.category, risk: tool.risk, reason: 'The tool requested a device outside the selected Agent scope.' };
+  }
+  if (policy?.expiresAt && Date.parse(policy.expiresAt) <= Date.now()) {
+    return { decision: 'deny', category: tool.category, risk: 'high', reason: 'The Agent permission policy has expired.' };
+  }
+  const category = TOOL_CATEGORY_ALIASES[tool.name.replace(/^livedesk\./, '')] || tool.category;
+  const constraintError = safeAutoConstraint(tool, args, policy?.mode);
+  if (constraintError) {
+    return { decision: 'deny', category, risk: tool.risk, reason: constraintError };
+  }
+  const decision = normalizeDecision(policy?.categories?.[category], 'deny');
+  return {
+    decision,
+    category,
+    risk: tool.risk,
+    reason: decision === 'allow' ? `Allowed by ${policy?.mode || 'current'} policy.` : decision === 'ask' ? 'This operation requires approval in the current policy.' : 'This operation is denied by the current policy.'
+  };
+}
+
+export const DEFAULT_CUSTOM_AGENT_PERMISSION_CATEGORIES = Object.freeze({ ...DEFAULT_CUSTOM_CATEGORIES });